Privacy

Who we are

Elaris TCG is a free anime card-collecting game, developed and operated as an independent project (see the legal notice). This page explains what data is collected, why, and how you can control it.

Data collected

• Account — username, email address, password. The password is never stored in plain text or encrypted (encryption can be decrypted with a key — that is not the case here): it is hashed, a one-way transformation. Even we cannot retrieve your password from what is stored — we can only check that an entered password matches it.
• Game — crystals, cards owned, trades, shop purchases, progression and ranking statistics.
• Social — messages exchanged with your friends in the game, friend requests.
• Security — IP addresses of login attempts, kept for rate limiting (anti brute-force protection) and abuse detection.
• Technical — session cookie, strictly necessary for the site to function (staying logged in). This cookie does not require a consent banner, in accordance with regulations applicable to strictly necessary cookies.

This data is only used to make the game work. No advertising tracker or audience-analysis tool (Google Analytics, Meta Pixel, or equivalent) is integrated into the site at this time.

Password verification

At sign-up and when changing password, Elaris TCG checks that the chosen password does not already appear in a known public data breach, via a specialized service (Have I Been Pwned). Your password is never sent to this service, either in plain text or in a form that would allow it to be recovered.

Retention period

Account data is kept for as long as the account exists. An account deletion request triggers a withdrawal period of 30 days: the account becomes immediately inaccessible, but nothing is erased yet, giving you time to cancel in case of a mistake (by logging back in). After this period, personal data (username, email, password, bio, avatar) is permanently anonymized; economic data already linked to other players (completed trades, market sales) is kept in anonymized form to preserve the game's consistency. Login attempt logs (IP addresses) are kept for a limited time, strictly necessary for the security of the service.

Your rights

In accordance with the GDPR, you have the right to access, rectify, erase, and port your personal data:

• Access and portability — download a copy of your data from Settings → Export my data.
• Rectification — edit your profile directly from Settings.
• Erasure — delete your account at any time from Settings.

For any other question or request regarding your personal data, contact: support@elaris.fun